Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About kartm2020
kartm2020
Communicator
Member since:
03-10-2020
03-14-2024
Community Statistics
| Posts | 78 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 03-10-2020 |
Activity Feed
- Posted Re: Splunk - Rest API - Curl - Failing with Unbalanced Quotes on Getting Data In. 03-14-2024 12:13 AM
- Posted Re: sendMail "From= " on Splunk Enterprise. 03-13-2024 11:35 PM
- Posted Re: How to merge the Single viz and table vis in same row in splunk dashboard XML on Splunk Enterprise. 12-11-2022 11:11 PM
- Posted How to merge the single viz and table vis in same row in Splunk dashboard XML? on Splunk Enterprise. 12-11-2022 02:28 AM
- Tagged How to merge the single viz and table vis in same row in Splunk dashboard XML? on Splunk Enterprise. 12-11-2022 02:28 AM
- Tagged How to merge the single viz and table vis in same row in Splunk dashboard XML? on Splunk Enterprise. 12-11-2022 02:28 AM
- Posted Re: Can we able to merge the column headers like excel on Dashboards & Visualizations. 11-25-2021 10:34 PM
- Posted Can we able to merge the column headers like excel on Dashboards & Visualizations. 11-25-2021 03:34 AM
- Posted Re: How to add the field values based on the criteria on Splunk Search. 11-02-2021 11:42 PM
- Tagged How to add the field values based on the criteria on Splunk Search. 11-02-2021 11:09 PM
- Posted How to add the field values based on the criteria on Splunk Search. 11-02-2021 11:07 PM
- Posted Re: Splunk search - How to search the fields1 values contains in field2 on Splunk Search. 08-22-2021 07:50 AM
- Posted Re: Splunk search - How to search the fields1 values contains in field2 on Splunk Search. 08-21-2021 02:16 AM
- Posted Re: Splunk search - How to search the fields1 values contains in field2 on Splunk Search. 08-21-2021 01:10 AM
- Posted Splunk search - How to search the fields1 values contains in field2 on Splunk Search. 08-20-2021 07:21 AM
- Posted Data is not rolling out from warm to Cold bucket on Splunk Enterprise. 06-10-2021 02:27 AM
- Posted Sending CSV file from application server to splunk via HTTP Event collector on Getting Data In. 05-24-2021 06:38 AM
- Karma Re: Javascript - Splunk onclick function not working on second click in same row for kamlesh_vaghela. 06-05-2020 12:51 AM
- Posted Re: Javascript - Splunk onclick function not working on second click in same row on Splunk Dev. 06-01-2020 11:50 PM
- Posted Re: Javascript - Splunk onclick function not working on second click in same row on Splunk Dev. 06-01-2020 06:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-12-2020
06:22 AM
Hi @clementros
It is always recommended to install the same version in both indexers and forwarders. However the issue is with crclength. So you need to increase the initcrclength attribute value 512 or 1024. Try it first 512 if it doesnt works try with 1024. Increase the value by 256.
Default value of inicrclength is 256
[monitor:///prddata/JobOutput//.err]
index=fileauxnfmerrorlogs
sourcetype=fcravd10logfile
initCrcLength = 1024
Hope it works. Let me know if you are facing error after you did the above changes.
You can also go through the below link.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/Howlogfilerotationishandled
Happy splunking!!!
... View more
01-20-2020
05:40 AM
Thank you. May i know what is the exact error message that comes in splunkd.log? Give me some sample output. it will help me a lot
... View more
01-20-2020
05:28 AM
I just need to find the reason of indexer down in splunk
... View more
- Tags:
- splunk-enterprise
12-05-2019
05:01 AM
Hi Pratapa,
Can you please provide the type of logs ?
Is it stopped from all the sources or Host or Sourcetype ?
... View more
12-05-2019
03:19 AM
Please try the below
| rex field=_raw "http:..(?P\w+-\w+-\w+)-oic-(?P.*.com)"
If the data look likes above, this regex will work. But the data contains numbers in between word. We need to write different regex.
Kindly let me know if it works.
... View more
12-04-2019
11:06 PM
Where from can we download the datetime.xml file.
Link :https://download.splunk.com/products/ingest2020/datetime.zip
You can use wget method for downloaind this XML File.
What is the path where datatime.xml file resides in the server.
/Opt/splunk/etc
What is the path in the server where we can upload the downloaded datetime.xml file.
I would like to recommend you to download the XML in /opt file path . Then you can move to /opt/splunk/etc. It will ask you to overwrite. Select Yes.
What modifications we need to do once we upload the datetime.xml file
You have to replace the existing datetime.xml file in /opt/splunk/etc
How to upgrade Splunk platform instance to a version with an updated version of datetime.xml.
No need upgrade the splunk platform instance. This changes is enough.
On which servers we need to upload the datetime.xml.
Splunk Forwarder
Splunk Indexer
Splunk License server.
On all the Splunk instance.
Is a reboot of the server required after the upgrade or if we restart splunk services it is enough.
Restarting the splunk service is more enough.
... View more
11-14-2019
05:02 AM
Hi,
There are two steps you need to perform.
1. Uploading the lookup file
First you have to create the .csv where you need to fill the IP address in first column and name would be in the another column.
Go to lookups ->Lookup table files >> New lookup file
Give the name of the lookup filename. this name will be lookup name for splunk. filename should end with .csv
Creating automatic lookup:
Once you are done with uploading the file. Next step is create automatic lookup.
Go to lookups ->Automatic lookups >> New Automatic lookup
Select the destination app and fill the name whichever you want.
You have to select the lookup table which you have given previously(lookup filename)
Give the source type which you want to apply this lookup
Now, you have to fill the input and output field.
In your example , IP address will be the input field and Name will be the output field.
IPAddress = IPAddress
Name=Name
Click save.
If you search with the sourcetype, you will get the new field with "Name"
Please let me know for any challenges.
... View more
11-07-2019
06:10 AM
Hi Neovenkat,
I think this is due to replication factor. Setting the replication in search head clustering is optional. I have the same environment as like yours. If you see below server.conf, i haven't set the rep factor.
Please remove rep factor and do the splunk restart and try again. I hope it will work.
server.conf:
[shclustering]
conf_deploy_fetch_url = https://XX.XX.XX.XX:8089
disabled = 0
mgmt_uri = https://XX.XX.XX.XX:8089
pass4SymmKey = *****
shcluster_label = shcluster1
id = ****
... View more
11-07-2019
05:42 AM
Try this.
It will fetch the number followed by digits.
| rex field=field_name "A-Z"
If you have non-capital words. try the below
| rex field=field_name "[A-Z]a-z"
... View more
11-05-2019
09:52 PM
Hope i understand the requirement. Please try the below query.
| stats count(session_id) by userAgent, browserVersion, osName
Please let me know if it doesn't meet your requirement
... View more
10-30-2019
07:29 AM
Hi,
If you are creating an app, it will store under /etc/apps. Inside local directory whatever conf file you have mentioned and it will applicable only for the particular app.
You have asked directory structure for an app. Please refer the below link.
https://dev.splunk.com/enterprise/docs/developapps/createapps/createsplunkapp/
... View more
10-30-2019
07:21 AM
Hi,
As per your comment, If the character is alphanumeric value. Below regex will help you extract.
| rex field=_raw "(?P[A-Z0-9]{4})"
Please correct me if my understanding is wrong.
You can test it : https://regex101.com/r/j7u1vF/1
You can change the value inside parenthesis as per your requirement( I pretend it is 4 character value)
... View more
10-29-2019
07:47 AM
I have asked the same question. They told it seems file might be crashed. They suggested to install the new license which they have provided.
... View more
10-29-2019
07:29 AM
Hi,
By default all the forward ports should be 9997.
UF will forward the data to HF with 9997. From HF it will parse and again send it to indexer with 9997.
8089 port is only for management port.
Configure your Heavy forwarder to listen 9997 port and configure your indexer with 9997. There are 2 layers of transforming data. Please ensure all firewall or NSG(for Azure) is opened.
Details of configuring receiving port:
To configure the indexer/heavy forwarder to receive data from other Splunk Enterprise instances:
Log into Splunk Enterprise on the indexer.
In the system bar, click Settings > Forwarding and Receiving. Splunk Enterprise loads the "Forwarding and Receiving" page.
Under "Receive Data" click Configure Receiving.
Click New.
In the Listen on this port field, enter the port number that you want Splunk Enterprise to listen on for incoming data from other Splunk instances. The conventional port number is 9997.
Click Save. Splunk Enterprise saves the port number and enables receiving on the indexer.
Reference link :https://docs.splunk.com/Documentation/MSExchange/3.5.2/DeployMSX/InstallaSplunkIndexer
... View more
10-29-2019
07:23 AM
Raise a splunk support case. They will issue a new splunk.license file. Please try again.
It was worked for me.
... View more
10-25-2019
02:41 AM
Hi Vikcee,
Please modify as like below
props.conf
[your_sourcetype]
TRANSFORMS = session-anonymizer
transforms.conf
[session-anonymizer]
DEST_KEY = _raw
REGEX = ^SERVICE NOTIFICATION:\s\d+
FORMAT = $1xxxxxxxxxx
To answer your question.
By default splunk will extract the field. Sometimes splunk would n't able to extract the field. So we need to write a regex to extract the field whichever we want. In this scenario, we must need to write to regex to tell splunk which wants to be masked.
... View more
10-25-2019
02:17 AM
We have two different scheduled search and it is providing the two different result. I would like send the both of the results in a single email.
Is it possible ?
... View more
10-22-2019
10:37 PM
Can you please try the below.
inputlookup file.csv | rename 'Service*' as service
Instead of using '' please use '
... View more
10-21-2019
12:04 AM
It is working as partial. I would like to display all the source and destination with respect to status(Either STATE UP or STATE DOWN.
Your query display the latest destination (Ignoring some destination).
... View more
10-20-2019
11:37 PM
I would like to display the current status(either state up or state down) with respect to src destination and port
... View more
10-20-2019
11:36 PM
if you see the image STATE UP and STATE DOWN status are showing in it. I would like display the single row with current status(Either STATE UP or STATE DOWN not the both)
for all source and destination
... View more
10-20-2019
11:10 PM
Hi Woodcock,
I am getting the same result even if i include sort command. Please find the below url of entire search.
https://ibb.co/cbRGzyw
... View more
10-20-2019
11:09 PM
Hi Moliminous,
Please find the below link of entire search result.
https://ibb.co/cbRGzyw
... View more
10-18-2019
03:24 AM
Hi nmarinov,
Can you pleae try the below query and let me know whether it is working as expected.
index=my_index asset_atp="false" earliest=-1d@d latest=-0d@d | eval ExceptionType=if(searchmatch ("Workstation"), ("ACTIVE"),("false")
| eventstats dc(ExceptionType) AS numExceptionTypes values(ExceptionType) AS ExceptionTypes | search numExceptionTypes=1 AND ExceptionType="false"
I have tried my level best based on your inputs. Lets c 🙂
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-14-2024
05:50 AM
|
